Cybersecurity attacks have become a pervasive problem for organizations as many electronic devices and other resources have been subjected to attack and compromised. An attack may involve the infiltration of malicious software onto an electronic device or concentration on an exploit residing within an electronic device to perpetrate the cybersecurity attack. Both of these types of attacks are the result of “malware.”
In particular, cyber-attacks (e.g., ransomware attacks) have become increasingly common and may lead to the loss of important data. Ransomware is a type of malware that attempts to installs itself covertly on a victim's network device, or is installed covertly, and carries out a cryptoviral extortion by holding data hostage until a ransom is paid. In one situation, ransomware may encrypt data and request a payment to unencrypt the data. Alternatively, ransomware may modify data such that the data is unreadable or otherwise inaccessible and request payment to return the data to its original form. As used herein, the term “unreadable” may be broadly interpreted as data that cannot be displayed by an application corresponding to the file type containing the data (e.g., data of a Portable Document Format (PDF) file that cannot be displayed by Adobe Reader is said to be “unreadable”).
Many current ransomware detection techniques cannot prevent attacks before they happen and thus cause data inaccessibility from “file-zero” (i.e., the first file affected by the ransomware) unless a ransom is paid. Current techniques of monitoring often cannot protect the first file because they rely on post modification detection techniques. Specifically, current ransomware detection techniques typically analyze the victimized system (e.g., a network device or a plurality of network devices) to determine at least the malware that caused the encryption of the data as well as the encryption method. For example, current ransomware detection techniques may analyze a victimized network device to determine a software application or program that was downloaded (e.g., a Trojan which contained the ransomware). A signature of the detected software application or program, or portion thereof containing the ransomware, may be added to a blacklist to be used for future malware scans in an attempt to detect the ransomware before it is executed and its attack is carried out.
However, current ransomware detection techniques fail to protect the initial victimized network device (or plurality of network devices) from ransomware attacks. Thus, the initial ransomware attack may succeed in locking one or more victims out of accessing data that is being held hostage. As a result, the victim or victims, may lose the data or may be forced to pay a ransom in hopes of having the data being held hostage returned. Such a situation may have very negative consequences, especially if accessing the data is time sensitive (e.g., patient data in hospitals). Therefore, enhancements to current ransomware detection systems are needed to prevent the loss of data from “file-zero.”